Skip to content
OpenAdvisories
Medium WID-SEC-2026-2536 19 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Jul 27, 2026 · Updated Nov 12, 2026 · Revision 37 · de

Vendor: amazon Vendor: Debian Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um den Speicher zu beschädigen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-64541

    net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-64551

    sctp: validate STALE_COOKIE cause length before reading staleness

    In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-by…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64554

    netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64555

    KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-64548

    bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-64552

    virtio-net: fix len check in receive_big()

    In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-64540

    usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

    In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-suppli…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-64547

    net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

    In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64539

    Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64543

    tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX soft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-64545

    net, bpf: check master for NULL in xdp_master_redirect()

    In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2026-64550

    net: qualcomm: rmnet: validate MAP frame length before ingress parsing

    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-64546

    drm/edid: fix OOB read in drm_parse_tiled_block()

    In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64537

    bridge: cfm: reject invalid CCM interval at configuration time

    In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). W…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-64538

    ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64542

    ipv6: ndisc: fix NULL deref in accept_untracked_na()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64544

    crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

    In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64549

    Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64553

    net: psample: fix info leak in PSAMPLE_ATTR_DATA

    In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLE_ATTR_DATA psample open codes nla_put() presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing cle…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #37

    Neue Updates von Ubuntu aufgenommen

  2. #36

    Neue Updates von Red Hat aufgenommen

  3. #35

    Neue Updates von Ubuntu aufgenommen

  4. #34

    Neue Updates von Ubuntu aufgenommen

  5. #33

    Neue Updates von Oracle Linux aufgenommen

  6. #32

    Neue Updates von SUSE und Oracle Linux aufgenommen

  7. #31

    Neue Updates von Red Hat aufgenommen

  8. #30

    Neue Updates von Red Hat aufgenommen

  9. #29

    Neue Updates von Ubuntu aufgenommen

  10. #28

    Neue Updates von SUSE aufgenommen

  11. #27

    Neue Updates von SUSE aufgenommen

  12. #26

    Neue Updates von SUSE aufgenommen

  13. #25

    Neue Updates von Ubuntu und SUSE aufgenommen

  14. #24

    Neue Updates von Oracle Linux aufgenommen

  15. #23

    Neue Updates von SUSE aufgenommen

  16. #22

    Neue Updates von Oracle Linux aufgenommen

  17. #21

    Neue Updates von Ubuntu aufgenommen

  18. #20

    Neue Updates von Ubuntu aufgenommen

  19. #19

    Neue Updates von Ubuntu aufgenommen

  20. #18

    Neue Updates von SUSE aufgenommen

  21. #17

    Neue Updates von SUSE aufgenommen

  22. #16

    Neue Updates von openSUSE, SUSE und Ubuntu aufgenommen

  23. #15

    Neue Updates von SUSE aufgenommen

  24. #14

    Neue Updates von SUSE aufgenommen

  25. #13

    Neue Updates von SUSE aufgenommen

References